VB2014 preview: Tech Support Scams 2.0: an inside look into the evolution of the classic Microsoft tech support scam

Posted by   Virus Bulletin on   Sep 22, 2014

Jérôme Segura looks at recent developments in malicious cold calls.

In the weeks running up to VB2014 (the 24th Virus Bulletin International Conference), we are looking at some of the research that will be presented at the event. Today, in the final entry in this series, we look at the paper 'Tech Support Scams 2.0: an inside look into the evolution of the classic Microsoft tech support scam' , by Jérôme Segura (Malwarebytes).

Two years ago, at VB2012 in Dallas, I co-presented a paper on tech support scams. Somewhat naively, I expected the scams to die out before too long: soon, enough people would know not to trust people calling about computer issues that the scam would stop being profitable to the scammers.

I couldn't have been more wrong, and no one knows this better than Jérôme: on the Malwarebytes blog, he has written many posts about his adventures with support scammers. Adventures which tend to be quite hilarious - until one realises that real people continue to fall victim to such scams.

In his paper, Jérôme explains how the scam has evolved: not only do many callers no longer claim they are calling on behalf of Microsoft, they have also broadened their scope, and apart from Windows are now also targeting Mac and Android users.

Scammers continue to find inventive ways to 'prove' something is wrong with the victim's computer or device, such as a failing ping to protection.com (a domain that doesn't accept ICMP requests) or the 'ESTABLISHED' shown by the netstat command as a proof that bad guys are currently and actively stealing all your information.

  Netflix phishing page leading to support scams. Source: Malwarebytes.

In one instance, the scammers used a Netflix phishing page which gave a login error (but allowed the crooks to steal the credentials) and urged the victim to call a phone number, upon which they would be told that their computer had been hacked - something that could only be fixed after paying a hefty fee.

Support scams continue to evolve, and in his presentation, Jérôme will talk about a number of recent developments that occurred after he submitted the paper. These include scammers claiming to be the official support technicians of various security products (something that no doubt will be of interest to many attendees), as well as further evidence of scams operating from within the US itself.

  Scareware leading to support scams. Source: Malwarebytes.

The paper finishes with a number of useful suggestions for those who, like Jérôme, want to gather intelligence on support scammers. Many will not want to go as far as the Metasploit researcher who released a zero-day exploit in Ammyy, a remote access tool popular among scammers, with the purpose of 'fighting back'. However, there are other, less ethically dubious ways to gather intelligence on these scams and the tactics used; they will help prevent people from falling victim.

VB2014 takes place next week in Seattle. Registration for VB2014 is still possible.

Posted on 22 September 2014 by Martijn Grooten



Latest posts:

VB2019 paper: APT cases exploiting vulnerabilities in region-specific software

At VB2019, JPCERT/CC's Shusei Tomonaga and Tomoaki Tani presented a paper on attacks that exploit vulnerabilities in software used only in Japan, using malware that is unique to Japan. Today we publish both their paper and the recording of their…

New paper: Detection of vulnerabilities in web applications by validating parameter integrity and data flow graphs

In a follow-up to a paper presented at VB2019, Prismo Systems researchers Abhishek Singh and Ramesh Mani detail algorithms that can be used to detect SQL injection in stored procedures, persistent cross-site scripting (XSS), and server‑side request…

VB2020 programme announced

VB is pleased to reveal the details of an interesting and diverse programme for VB2020, the 30th Virus Bulletin International Conference.

VB2019 paper: Cyber espionage in the Middle East: unravelling OSX.WindTail

At VB2019 in London, Jamf's Patrick Wardle analysed the WindTail macOS malware used by the WindShift APT group, active in the Middle East. Today we publish both Patrick's paper and the recording of his presentation.

VB2019 paper: 2,000 reactions to a malware attack – accidental study

At VB2019 cybercrime journalist and researcher Adam Haertlé presented an analysis of almost 2000 unsolicited responses sent by victims of a malicious email campaign. Today we publish both his paper and the recording of his presentation.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.